| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the response identifier to the outstanding request, or verify the RFC 2865 `Response Authenticator`; the RFC 2869 `Message-Authenticator` is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success. On a deployment with a `RADIUS` module instance enabled on a login chain, an unauthenticated network attacker can race the real server on-path or spray forged `Access-Accept` packets off-path and obtain a session for any `RADIUS`-mapped username without knowing the shared secret. Unlike CVE-2024-3596, exploitation requires no MD5 chosen-prefix forgery because no response authenticator is checked. The resulting session carries the impersonated principal's privileges. This issue is fixed in version 16.1.1. |
| PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-mcp` reads `MCP_API_KEY` and logs that `X-API-Key` authentication is enabled but never validates the `X-API-Key` header on incoming requests. The `/mcp` endpoint consequently accepts unauthenticated clients. With the default bind address of `0.0.0.0`, any client able to reach the port can invoke every PDF tool and read any PDF the server process can open on the host, despite the misleading authentication-enabled startup log. URL-based sources additionally permit limited server-side request forgery; private and loopback destinations are blocked by default unless `--allow-private-ips` is set. The default `stdio` transport is unaffected. This issue is fixed in version 3.0.1. |
| Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. |
| Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. |
| Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. |
| Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions. |
| Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. |
| Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions. |
| Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions. |
| Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions. |
| Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions. |
| Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions. |
| Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions. |
| Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions. |
| Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions. |
| Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions. |
